exporter: default attestation manifests to OCI artifacts

[maxpetrusenkoagent]

Summary

• Default attestation manifests to OCI artifacts whenever the resolved image output uses OCI media types.
• Preserve oci-artifact=false as the opt-out path for the legacy attestation image manifest format.
• Add focused option-defaulting coverage and an integration test case for the omitted oci-artifact exporter option.
• Update README and attestation storage docs for the new default.

Fixes #6171

Verification

• go test ./exporter/containerimage -run TestImageCommitOptsSetOCIArtifactDefault -count=1 -v
• go test ./exporter/containerimage ./exporter/oci
• go test ./exporter/...
• SKIP_INTEGRATION_TESTS=1 go test ./client ./client/...
• git diff --check

Attempted full client package test without skipping integration:

• go test ./client/... ./exporter/containerimage ./exporter/oci
• Result: failed before exercising this change because the local macOS test environment is missing the registry binary required by the integration mirror setup (failed to lookup registry binary). The skipped-integration run above verifies compile/unit coverage for the client packages.

Second-agent review

Reviewer used: hermes chat -Q fallback. claude -p was attempted first but failed authentication with a 401.

Result: CLEAN

Reviewer summary: no blocking correctness, regression, security, duplicate/superseded-work, or maintainer-fit issues found. The reviewer called out that the explicit oci-artifact=false opt-out is preserved, defaults are applied before validation in both image and OCI exporters, tests cover default/explicit behavior, and the diff matches the direction from #6171/#5573.

Created with: Hermes Agent